CVE-2026-107225 is an improper input validation vulnerability in the Go library excelize versions 2.8.0 through 2.11.0. The vulnerability arises because the GetStyle function's predicates only check upper bounds for style-table indices, allowing negative indices to be used. When a crafted styles.xml file contains negative fillId, borderId, or fontId values, these negative values bypass the upper-bound checks and cause negative slice indexing, leading to a panic during cell styling reads. No fix is currently available for this issue.
CVE-2026-107224 is an integer overflow vulnerability in the qax-os excelize library affecting versions from 2.1.0 through 2.11.0. It arises from improper handling of Zip64 uncompressed sizes that, when set to values with the high bit set, cast to negative int64 values. This bypasses unzip size guards and leads to a panic due to a negative capacity passed to Go's make function, causing a runtime error and crashing the calling goroutine. The vulnerability can be triggered by a crafted 159-byte archive without authentication.
CVE-2026-107223 is a high-severity vulnerability in the qax-os excelize Go library for handling Microsoft Excel spreadsheets. Versions from 2.1.0 through 2.11.0 are affected. The flaw arises because the library's flatCols function expands column ranges without validating the Min and Max column indices against the worksheet's column limit. An attacker can craft a worksheet with an excessively large column max attribute, causing the library to allocate excessive memory and CPU during column mutation operations, potentially leading to out-of-memory conditions. No official fix or patch is currently available.
CVE-2026-107222 is a medium severity vulnerability in the qax-os excelize Go library versions 2.7.0 through 2.11.0. It involves improper validation of array indexes during conditional-format extraction, which can cause out-of-range indexing or nil dereferences when processing malformed worksheet rules. This can lead to a panic that terminates an unprotected process. No fixed version is currently available.
CVE-2026-107221 is an out-of-bounds write vulnerability in the qax-os excelize library affecting versions from 2.0.0 up to and including 2.11.0. The flaw occurs in the checkRow function when processing spreadsheet rows with cells that are not sorted by column in the XML, causing an index out of range panic and process crash. This affects worksheet API calls such as GetCellValue, GetCellFormula, CalcCellValue, GetMergeCells, and SetCellValue. The vulnerability leads to an unauthenticated denial of service via a deterministic panic. A fix involves correcting the sizing of internal data structures to handle unordered cells properly.
CVE-2026-107220 is an out-of-bounds read vulnerability in the qax-os excelize Go library versions 2.7.1 through 2.11.0. The issue occurs when processing a crafted worksheet containing an empty mergeCell ref, leading to an empty cached rectangle slice being passed without length checks. This causes an out-of-bounds slice access in cellInRange, resulting in a panic during cell operations. No fix is currently available.
CVE-2026-107219 is an uncontrolled resource consumption vulnerability in the qax-os excelize library. The vulnerability arises because the library processes the spinCount parameter from an encrypted file's EncryptionInfo stream without bounds, causing excessive CPU usage during key derivation. This leads to a denial of service by making file opening operations take an excessive amount of time. The vulnerability affects versions from 2.3.1 through 2.11.0. It impacts availability only and does not affect confidentiality or integrity. Legitimate files use a much lower spinCount, so normal usage is not impacted significantly.
CVE-2026-107218 is a medium severity vulnerability in the Go library excelize (versions 2.10.1 through 2.11.0) used for reading and writing Microsoft Excel spreadsheets. The issue arises from improper validation of array indices in the RIGHT function, which inconsistently uses UTF-16 code-unit counts and Unicode code-point counts when slicing strings. This mismatch can cause a negative index panic during formula evaluation when processing supplementary-plane Unicode characters. No fix is currently available for this vulnerability.
CVE-2026-107217 is an integer overflow vulnerability in the Excelize Go library used for reading and writing Microsoft Excel spreadsheets. The function ColumnNameToNumber does not detect overflow when converting long column names to numeric indices, causing a wraparound to zero. This leads to a negative slice index during worksheet normalization, which can cause the application to panic and terminate unexpectedly. No fixed version is currently available.
CVE-2026-107216 is a high-severity vulnerability in the qax-os excelize Go library versions 2.8.1 through 2.11.0. It involves uncontrolled recursion caused by the ANCHORARRAY function recursively calling CalcCellValue, which creates a new calculation context on each call and bypasses cycle detection mechanisms. This leads to a fatal Go stack overflow and process abort when mutually referencing dynamic-array formulas are evaluated. No fix is currently available.
CVE-2026-107215 is a high-severity vulnerability in the qax-os excelize Go library for Microsoft Excel spreadsheets. Versions from 2.3.1 up to and including 2.11.0 improperly allocate memory based on attacker-controlled size values from OLE compound file streams without proper validation. This can lead to excessive memory allocation or negative length allocations, causing process crashes or memory exhaustion. No patch or fixed version is currently available.
CVE-2026-107214 is a high-severity vulnerability in the qax-os excelize Go library versions 2.3.1 through 2.11.0. The issue arises from insufficient validation of attacker-controlled encryption data before decryption routines are invoked, leading to uncaught exceptions and Go runtime panics. This can cause the calling process to terminate unexpectedly when processing malformed OLE compound files with valid versioned EncryptionInfo streams. No patch or fixed version is currently available.
CVE-2026-107213 is a high-severity vulnerability in the qax-os excelize Go library versions 2.9.0 through 2.11.0. The flaw is a NULL pointer dereference caused by the GetSlicers function accessing a worksheet drawing element without verifying its existence. This can cause the application to panic and terminate when processing a crafted Excel worksheet containing an extLst element but lacking the drawing element. No fix is currently available for this issue.
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.
CVE-2026-107211 is a high-severity vulnerability in the qax-os excelize library involving improper validation of array indices when processing pivot tables in .xlsx files. The vulnerability arises because the library indexes arrays with attacker-controlled integers from pivot table XML parts without bounds checking, leading to runtime panics (index out of range errors). This can cause the host process to crash when opening crafted malicious Excel files containing pivot tables. The issue affects versions from 2.8.1 through 2.11.0. No official patch or fix is currently documented.
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet() function in github.com/xuri/excelize/v2 uses an attacker-controlled <row r="N"> XML attribute value directly as the length argument to make([]xlsxRow, row) without validating it against the Excel row limit (TotalRows = 1,048,576). A specially crafted XLSX file can trigger two denial-of-service variants: (A) an out-of-memory process kill when r=2147483647 forces a ~16 GB allocation attempt, and (B) a runtime panic via out-of-bounds slice indexing when r=-1. Any service that opens attacker-supplied XLSX files and calls GetCellValue is affected. No authentication is required. This issue is fixed in version 2.11.0.
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, Excelize parses shared-string cell values with strconv.Atoi and checks only the upper bound before indexing the shared string slice, allowing an XLSX file containing a shared-string cell with -1 to trigger sharedStrings[-1] and panic when read through GetCellValue or GetRows. This issue is fixed in version 2.11.0.
Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the streaming worksheet reader used by Rows and GetRows does not enforce the TotalRows limit on the row r attribute, allowing a small XLSX file with a row number above 1048576 and no cell coordinate to make GetRows append empty rows up to the attacker-controlled index and consume excessive memory and CPU. This issue is fixed in version 2.11.0.